{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "preinstall.js",
              "sha256": "262b16adf1bace2120413f6a3025270b078db5dc743e40ea771aff18c8b5b623",
              "tlsh": "bd0110c9aaab97742bf4f3c0b180940593b2d308bc0315a776ba63ed2745ee44361f70"
            },
            {
              "path": "package.json",
              "sha256": "04e781ef8158e77b2a810790fe85b2fb2c9dc1b4923b8773c8f0b57f577ccfbb",
              "tlsh": "0ff0123387e14eb725b8bb51b4936902b3f34e7f2151880ab3b9240d9ab059207cfb16"
            }
          ],
          "package_integrity": [
            {
              "filename": "api-tools-2.0.3.tgz",
              "hashes": {
                "sha1": "3e9864b9a7b6fe48f06ba8a2739989a77e8e71e0",
                "sha512_sri": "sha512-dD0OZMMpWFgrUrsjPNosWo1KXqh6GqcALX4GI29BwA41zvBnh3BijVonCn+CQF6Cq65lsSfj3cB1JTy4/Ti4CQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@mep-exp/api-tools"
      },
      "versions": [
        "2.0.3"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007054",
        "import_time": "2026-06-19T05:16:49.915689755Z",
        "modified_time": "2026-06-19T05:03:19Z",
        "sha256": "322089c1a58142401c82621aa778cdb7221086196cce6c879a703625b7013555",
        "source": "amazon-inspector",
        "versions": [
          "2.0.3"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (322089c1a58142401c82621aa778cdb7221086196cce6c879a703625b7013555)\npreinstall.js, registered as scripts.preinstall and also required from the main module and every bin entry, collects os.hostname(), os.userInfo().username, os.platform(), process.cwd(), and a timestamp and POSTs them as JSON to https://webhook.site/1ba25769-0f80-4429-a7d2-409af5fa5adc. The request runs unconditionally during `npm install` (preinstall lifecycle) and on every require/CLI invocation, with errors silently swallowed. The package scope (@mep-exp) and bin names (mesh-swagger-cli, mesh-exp-entitlements, mesh-exp-routes, mesh-exp-api-clients, etc.) impersonate an internal Westpac \u0027MEP Experience Platform\u0027 toolchain, and the exfil payload includes a `note: \"Westpac CT\"` marker \u2014 consistent with a dependency-confusion attack against that organization\u0027s internal namespace published on public npm. The package provides no legitimate functionality beyond the beacon.\n",
  "id": "MAL-2026-6183",
  "modified": "2026-06-19T05:03:19Z",
  "published": "2026-06-19T05:03:19Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@mep-exp/api-tools/v/2.0.3"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @mep-exp/api-tools (npm)"
}